Vulnerability Description
A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Atp800 Firmware | >= 4.32, <= 5.31 |
| Zyxel | Atp800 | - |
| Zyxel | Atp700 Firmware | >= 4.32, <= 5.31 |
| Zyxel | Atp700 | - |
| Zyxel | Atp500 Firmware | >= 4.32, <= 5.31 |
| Zyxel | Atp500 | - |
| Zyxel | Atp200 Firmware | >= 4.32, <= 5.31 |
| Zyxel | Atp200 | - |
| Zyxel | Atp100 Firmware | >= 4.32, <= 5.31 |
| Zyxel | Atp100 | - |
| Zyxel | Atp100W Firmware | >= 4.32, <= 5.31 |
| Zyxel | Atp100W | - |
| Zyxel | Usg Flex 100W Firmware | >= 4.50, <= 5.31 |
| Zyxel | Usg Flex 100W | - |
| Zyxel | Usg Flex 200 Firmware | >= 4.50, <= 5.31 |
| Zyxel | Usg Flex 200 | - |
| Zyxel | Usg Flex 500 Firmware | >= 4.50, <= 5.31 |
| Zyxel | Usg Flex 500 | - |
| Zyxel | Usg Flex 700 Firmware | >= 4.50, <= 5.31 |
| Zyxel | Usg Flex 700 | - |
Related Weaknesses (CWE)
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisVendor Advisory
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisVendor Advisory
FAQ
What is CVE-2022-40603?
CVE-2022-40603 is a vulnerability with a CVSS score of 4.7 (MEDIUM). A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware v...
How severe is CVE-2022-40603?
CVE-2022-40603 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-40603?
Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Atp800 Firmware, Zyxel Atp800, Zyxel Atp700 Firmware, Zyxel Atp700, Zyxel Atp500 Firmware.